Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2023, 18:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a32e7483e78418ce7298eef00cfb0da0.exe
Resource
win7-20231023-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a32e7483e78418ce7298eef00cfb0da0.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
a32e7483e78418ce7298eef00cfb0da0.exe
-
Size
205KB
-
MD5
a32e7483e78418ce7298eef00cfb0da0
-
SHA1
bced0bf1bc4ccfada21a5e90b61cb2bb05d14e82
-
SHA256
43487c10c6482b20ec7e4acf8d95508f09b1b6f62c833690dbe453bd5dd4b90a
-
SHA512
c24179864b510d46a826b777054be86a94e49d611ed99971c249b3867a47b462788e17834c8a4ac63019ee5f55f0d07b6db741de5f387757f452551d666e937d
-
SSDEEP
768:W7BlphA7pARFbhKKVeIuKVeIaCgx+qsaCgx+qs9lRlCaw85nd5nHlkSPoheOiIJc:W7ZhA7pApaX0aX09r5w8NdNCSuxc
Score
9/10
Malware Config
Signatures
-
Renames multiple (2074) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\README.html.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8_RTL.mp4.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Common Files\System\wab32.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\ConvertReceive.wma.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jdk-1.8\jmc.txt.tmp a32e7483e78418ce7298eef00cfb0da0.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp a32e7483e78418ce7298eef00cfb0da0.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
205KB
MD523c9474d012eb03aba566a33b8169d77
SHA1061c9c870be9734dc2ba83c7e14909e4b32ef0dd
SHA256391f79af0bbdc08fd25b4fc44988a907faafd7013ce1b0650346b76c5a2e6144
SHA512943726ca887306c185176394598889c5f4a1037f5f6328cde211e81a8af700871cbbdc923e8f029b7a8d5494665f9379c6073e402e3da4f94542e3f948db936f
-
Filesize
206KB
MD5319991ed39462d48168fae999aad0540
SHA143196b22228c617ef615db9ab61290f26c6443f7
SHA256afcebbd692bda3bf939ac87a85cebc6d3c213c7132248dc710fdfae44fd2832d
SHA512dddf24f52d3296fbfe46c032a0a1d4a677c3dc37c2aed7543e4174d2a7f39e35e81ce4f3eee25ea6b0669e2027efa1759b0478bdd0b14b8e816513498ee88d93